Shipa 1573

internal/api/v1beta1/app_types.go

@@ -233,6 +233,9 @@ type AppSpec struct {
 
 	// ServiceAccountName specifies a service account name to be used for this application.
 	ServiceAccountName string `json:"serviceAccountName,omitempty"`
+
+	// SecurityContext specifies security settings for a pod/app, which get applied to all containers.
+	SecurityContext *v1.PodSecurityContext `json:"securityContext,omitempty"`
 }
 
 // MetadataItem represent a request to add label/annotations to processes

internal/chart/application_chart.go

@@ -57,6 +57,8 @@ type app struct {
 	// ServiceAccountName specifies a service account name to be used for this application.
 	// SA should exist.
 	ServiceAccountName string `json:"serviceAccountName"`
+	// SecurityContext specifies security settings for a pod/app, which get applied to all containers.
+	SecurityContext *v1.PodSecurityContext `json:"securityContext,omitempty"`
 }
 
 type deployment struct {
@@ -135,6 +137,10 @@ func New(application *ketchv1.App, framework *ketchv1.Framework, opts ...Option)
 		IngressController: &framework.Spec.IngressController,
 	}
 
+	if application.Spec.SecurityContext != nil {
+		values.App.SecurityContext = application.Spec.SecurityContext
+	}
+
 	for _, deploymentSpec := range application.Spec.Deployments {
 		deployment := deployment{
 			Image:   deploymentSpec.Image,

internal/chart/application_chart_test.go

@@ -226,6 +226,16 @@ func TestNewApplicationChart(t *testing.T) {
 		}
 		return &out
 	}
+	setPodSecurityContext := func(app *ketchv1.App) *ketchv1.App {
+		out := *app
+		fsGroup := int64(2000)
+		runAsUser := int64(3000)
+		out.Spec.SecurityContext = &v1.PodSecurityContext{
+			FSGroup:   &fsGroup,
+			RunAsUser: &runAsUser,
+		}
+		return &out
+	}
 
 	tests := []struct {
 		name        string
@@ -267,6 +277,16 @@ func TestNewApplicationChart(t *testing.T) {
 			framework:         frameworkWithClusterIssuer,
 			wantYamlsFilename: "dashboard-istio-cluster-issuer",
 		},
+		{
+			name: "istio templates with cluster issuer and pod security context",
+			opts: []Option{
+				WithTemplates(templates.IstioDefaultTemplates),
+				WithExposedPorts(exportedPorts),
+			},
+			application:       setPodSecurityContext(dashboard),
+			framework:         frameworkWithClusterIssuer,
+			wantYamlsFilename: "dashboard-istio-cluster-issuer-pod-security-context",
+		},
 		{
 			name: "istio templates without cluster issuer",
 			opts: []Option{